Privacy policy
Scan My Bags, Telegram bot @ScanMyBagsBot, and this website. Last updated: 3 November 2026
1. Who is responsible
Tom Snellman, Merianstraße 4, 63500 Seligenstadt, Germany
Email: support@scanmybags.xyz
A data protection officer is not required.
2. What the bot does
Scan My Bags checks crypto tokens and portfolios using public blockchain and market data. You send wallet addresses, token addresses or tickers in a Telegram chat; the bot replies with an automated scan.
3. Which data we process, and why
a) Your Telegram account (stored). Your Telegram user ID (a number; we do not store your name, username or phone number); the date you started the bot and, if you came via a link, the link's campaign code; whether and when you accepted the terms and agreed to the immediate start of Premium; your Premium status, daily usage counters and settings (morning screen, green-only view). Purpose: providing the bot, the free daily allowances and Premium. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
b) Purchases (stored). Plan, number of Stars, date and Telegram's payment reference. Payments are made in Telegram Stars and processed by Telegram; we receive no card, bank or other payment details. Purpose: delivering Premium, refunds, bookkeeping. Legal basis: Art. 6(1)(b) and (c) GDPR; records are kept for the period required by tax law (in Germany up to 10 years).
c) What you send to scan (not stored). Wallet addresses, token addresses, tickers and amounts are used only to create your scan. They are held in the bot's working memory for up to 30 minutes, so a scan can be shown in full after buying Premium, and are never written to the database or to log files. Wallet addresses can be personal data, because a wallet can belong to you. Legal basis: Art. 6(1)(b) GDPR.
d) Anonymous usage statistics (stored). Counts such as "a scan with 12 tokens was made at 14:03", without your user ID or any address. Purpose: understanding usage and capacity. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
4. Data providers
To read public data, the bot sends requests to these providers. The requests never contain your Telegram ID.
| Provider | What it receives | Why |
|---|---|---|
| Alchemy Insights, Inc. (USA) | wallet addresses you send (EVM and Solana) | read token balances; tell wallets from token addresses |
| DexScreener | token addresses | prices, liquidity, trading volume |
| CoinGecko | token addresses and IDs | sector, supply, price history |
| DefiLlama | nothing about you (public lists) | protocol revenue and TVL |
| GoPlus, RugCheck | token addresses | token safety checks |
Wallet addresses are sent only to Alchemy, which processes them on our behalf in the USA. The transfer is based on the EU standard contractual clauses (Module 2, controller to processor) in Alchemy's data processing agreement (Art. 46(2)(c) GDPR). All other providers receive only token addresses, which are not personal data.
The bot runs on a server we rent from DigitalOcean, LLC in Frankfurt am Main, Germany (region FRA1). DigitalOcean processes data on our behalf under a data processing agreement. Telegram processes your messages under its own privacy policy: telegram.org/privacy.
5. This website
This website is a static page hosted on Cloudflare Workers, operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare necessarily processes your IP address and technical request data to deliver the page and protect it from attacks. Legal basis: our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). Cloudflare may process data in the USA; it is certified under the EU-U.S. Data Privacy Framework, and its data processing agreement includes the EU standard contractual clauses.
We set no cookies, use no analytics and load no external fonts or scripts.
6. How long we keep data
Account data (3a): until you delete it with /forgetme in the bot or ask us to. Purchases (3b): as long as required by tax law. What you send to scan (3c): at most 30 minutes, in memory only. Daily database backups are kept for 14 days.
7. Your rights
You can ask for access, correction, deletion, restriction and data portability, and object to processing based on legitimate interest. /forgetme in the bot deletes your account data immediately (purchase records stay as required by law). For anything else, email support@scanmybags.xyz.
You can also complain to a data protection authority, for example the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de.
8. No automated advice
Scans are automated research based on public data, not financial advice and not a recommendation to buy, hold or sell.